Privacy Notice on the Processing of Personal Data pursuant to Article 13 of Regulation (EU) No. 2016/679

In accordance with EU Regulation 679/2016 on data protection (GDPR – General Data Protection Regulation), applicable from May 25, 2018, the processing of personal data must always be carried out based on the principles of fairness, lawfulness, transparency, and protection of the privacy and rights of the data subject.

In the privacy notice below, you can see how TWS Spare Parts has implemented the new guidelines to provide you with greater control and protection over your personal data. You will find what information we collect, why we process your personal data, and your rights.

Data Controller – Data Protection Officer The Data Controller is TWS Spare Parts, with its registered office at Via Guglielmo Oberdan, 95 22060 Arosio (CO) (hereinafter referred to as the “Controller”). The Data Protection Officer can be contacted at the email address info@twsspareparts.com for information on data processing.

Categories of Data The data processed by the Controller include, or may include: (i) personal data (first name, last name), business address, and contact details (landline phone, mobile phone, email address); (ii) bank and/or payment data; (iii) marketing data.

Purposes and Legal Basis of Processing – Legitimate Interest The data will be processed differently depending on the type of user: customer and potential customer.

For customers, TWS Spare Parts manages the ongoing or past contractual relationship, invoicing, and payments. It also manages the commercial, marketing, and promotional aspects of its offerings. The administrative management of information is carried out in accordance with the laws of the countries involved in the commercial relationship. For potential customers, data processing involves the periodic communication of company activity updates via email or SMS.

Processing Methods Your data is collected and processed lawfully and fairly for the purposes outlined above. It is processed using electronic and automated means, including entry and organization into databases, in compliance with GDPR security measures, and in a manner that ensures the security and confidentiality of the data.

Retention Period The data will be retained for no more than 10 (ten) years for administrative and commercial purposes, and in any case, only for the time strictly necessary to pursue the legitimate interest of the Controller. Periodically, through appropriate communication, TWS Spare Parts may ask for your consent to extend this period.

Rights to Access, Deletion, Restriction, and Portability The Controller informs you that you are entitled to the rights set out in Articles 15 to 20 of the GDPR. For example, by sending a specific request to the email address info@twsspareparts.com, you will have the opportunity to:

• Obtain confirmation as to whether or not your personal data is being processed;
• If data processing is in progress, access the data and information related to the processing;
• Obtain rectification of inaccurate data and the completion of incomplete personal data;
• Request deletion of the data concerning you if one of the conditions set out in Article 17 of the GDPR is met;
• Request, in the cases provided by Article 18 of the GDPR, restriction of the processing of your data.

Right to Object Pursuant to Article 21 of the GDPR, you also have the right to object at any time to the processing of your data carried out for the legitimate interest of the Controller by writing to the email address info@twsspareparts.com. In the event of an objection, the data will no longer be processed unless there are legitimate grounds to continue processing that outweigh your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Right to Lodge a Complaint with the Data Protection Authority The Controller further informs you that you may lodge a complaint with the Data Protection Authority if you believe your rights have been violated under the GDPR or any other applicable regulation, according to the procedures indicated on the website of the Data Protection Authority, accessible at www.garanteprivacy.it.